Lock Up Your Data

Far too many web database application designers rely entirely on “permiter defense” for 100% of their data security. But with increasingly complex applications and increasingly sophisticated attackers, it’s no longer adequate (if it ever was) to only use web server and simple middleware tools to lock up your data; you need full-stack security, down to the database level.

Database guru Josh Berkus will briefly go over some basic techniques for integrated data security for RDBMS-based web applications, including:

• Stopping SQL Injection
• Using SQL data abstraction for security
• How database permissions work
• After an attack: data auditing

While examples will be based on PHP & PostgreSQL, they should be applicable to other platforms.